fix(ansible/docker): make Docker repo codename overridable

'No package matching docker-ce' happens when Docker has no repo for the
VM's release codename (common on non-LTS Ubuntu). Add docker_apt_codename
(defaults to the detected release; override to e.g. noble on non-LTS) and
refresh the apt cache right after adding the repo so index errors surface
immediately instead of as a missing package.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

platform-infra/ansible/group_vars/all.yml

@@ -32,6 +32,10 @@ zfs_child_datasets:
   - { path: "customers" }
 
 # --- Docker -----------------------------------------------------------------
+# APT codename for Docker's repo. Defaults to the VM's release. Docker only
+# publishes repos for LTS + recent codenames — on a non-LTS Ubuntu (e.g.
+# oracular/plucky) set this to the nearest LTS, e.g. "noble".
+docker_apt_codename: "{{ ansible_distribution_release }}"
 # Native ZFS storage driver keeps image layers as ZFS datasets under the pool
 # (data-root sits on tank/platform/docker). Switch to overlay2 only if you have
 # a specific reason.

platform-infra/ansible/roles/docker/tasks/main.yml

@@ -16,9 +16,15 @@
     repo: >-
       deb [arch={{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}
       signed-by=/etc/apt/keyrings/docker.asc]
-      https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
+      https://download.docker.com/linux/ubuntu {{ docker_apt_codename }} stable
     filename: docker
     state: present
+  register: docker_repo
+
+- name: Refresh apt cache after adding the Docker repo
+  ansible.builtin.apt:
+    update_cache: true
+  when: docker_repo is changed
 
 - name: Ensure the ZFS docker dataset is mounted at the data-root
   ansible.builtin.command: "zfs get -H -o value mounted {{ zfs_pool_name }}/platform/docker"